CVE-2026-35523: CWE-306: Missing Authentication for Critical Function in strawberry-graphql strawberry
Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the on_ws_connect authentication hook entirely by connecting with the graphql-ws subprotocol and sending a start message directly, without ever sending connection_init. This vulnerability is fixed in 0.312.3.
AI Analysis
Technical Summary
CVE-2026-35523 is a missing authentication vulnerability (CWE-306) in strawberry-graphql's WebSocket subscription endpoints using the legacy graphql-ws subprotocol. The subprotocol handler fails to enforce the connection_init handshake before accepting start subscription messages, enabling remote attackers to bypass authentication by sending a start message directly. This flaw affects strawberry versions earlier than 0.312.3 and is resolved in version 0.312.3.
Potential Impact
An attacker can bypass authentication on WebSocket subscription endpoints, potentially gaining unauthorized access to subscription data or functionality. The CVSS score of 7.5 (high) reflects the network attack vector, no required privileges or user interaction, and high confidentiality impact without affecting integrity or availability. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade strawberry-graphql to version 0.312.3 or later, where this vulnerability is fixed. Since no official patch link or vendor advisory is provided, confirm the upgrade from the official strawberry-graphql release notes or repository. No other mitigations are indicated.
CVE-2026-35523: CWE-306: Missing Authentication for Critical Function in strawberry-graphql strawberry
Description
Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a connection_init handshake has been completed before processing start (subscription) messages. This allows a remote attacker to skip the on_ws_connect authentication hook entirely by connecting with the graphql-ws subprotocol and sending a start message directly, without ever sending connection_init. This vulnerability is fixed in 0.312.3.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-35523 is a missing authentication vulnerability (CWE-306) in strawberry-graphql's WebSocket subscription endpoints using the legacy graphql-ws subprotocol. The subprotocol handler fails to enforce the connection_init handshake before accepting start subscription messages, enabling remote attackers to bypass authentication by sending a start message directly. This flaw affects strawberry versions earlier than 0.312.3 and is resolved in version 0.312.3.
Potential Impact
An attacker can bypass authentication on WebSocket subscription endpoints, potentially gaining unauthorized access to subscription data or functionality. The CVSS score of 7.5 (high) reflects the network attack vector, no required privileges or user interaction, and high confidentiality impact without affecting integrity or availability. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade strawberry-graphql to version 0.312.3 or later, where this vulnerability is fixed. Since no official patch link or vendor advisory is provided, confirm the upgrade from the official strawberry-graphql release notes or repository. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-03T02:15:39.281Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d5314faaed68159a33991a
Added to database: 4/7/2026, 4:31:11 PM
Last enriched: 4/15/2026, 12:24:35 PM
Last updated: 5/22/2026, 9:28:24 PM
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.